T1505.001 — SQL Stored Procedures

Tactic: Persistence · Platforms: Windows, Linux

Adversaries may abuse SQL stored procedures to establish persistent access to systems. SQL Stored Procedures are code that can be saved and reused so that database users do not waste time rewriting frequently used SQL queries. Stored procedures can be invoked via SQL statements to the database…

Sub-technique of Server Software Component (T1505).

Sigma detection rules (2)

T1505.001 Server Software Component: SQL Stored Procedures

title: "T1505.001 Server Software Component: SQL Stored Procedures"
id: 9ecae9c9-1e61-4f86-bc3a-e0ea2fb7d32f
description: 'Detects SQL Server (sqlservr.exe) spawning command interpreters or scripting engines, consistent with abuse of stored procedures (e.g., xp_cmdshell) to establish OS-level persistence per T1505.001. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: xp_cmdshell_invocation_threshold, CLRAssemblyNameWhitelist, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1505/001
author: Shahrukh Khan
date: 2026-04-28
license: MIT
tags:
  - attack.persistence
  - attack.t1505.001

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '1'
    ParentImage|endswith: '\sqlservr.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\powershell_ise.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: selection

falsepositives:
  - Legitimate DBA scripts or monitoring tools that intentionally invoke OS commands from SQL Server via xp_cmdshell.

level: medium

T1505.001 Server Software Component: SQL Stored Procedures

title: "T1505.001 Server Software Component: SQL Stored Procedures"
id: 6556ddab-05a2-4bef-8efc-6483d3a458c6
description: 'Detection Strategy for SQL Stored Procedures Abuse via T1505.001. Retargeted from unrelated web-server config-test invocations (apache2ctl/httpd/nginx -t) to auditd EXECVE capture of interactive database CLI clients (mysql/psql/sqlite3) invoked with a CREATE PROCEDURE/CREATE FUNCTION statement inline, since auditd has no visibility into queries submitted over the DB wire protocol/socket, only into command-line arguments passed to a local client. Tune using: CommandRegex, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1505/001
author: Shahrukh Khan
date: 2026-01-28
license: MIT
tags:
  - attack.persistence
  - attack.t1505.001

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/mysql'
      - '/psql'
      - '/sqlite3'
  selection_procedure:
    - a1|contains: 'CREATE PROCEDURE'
    - a2|contains: 'CREATE PROCEDURE'
    - a3|contains: 'CREATE PROCEDURE'
    - a1|contains: 'CREATE FUNCTION'
    - a2|contains: 'CREATE FUNCTION'
    - a3|contains: 'CREATE FUNCTION'
    - a1|contains: 'CREATE OR REPLACE FUNCTION'
    - a2|contains: 'CREATE OR REPLACE FUNCTION'
    - a3|contains: 'CREATE OR REPLACE FUNCTION'

  condition: selection and selection_procedure

falsepositives:
  - Legitimate DBA/migration tooling that deploys stored procedures or functions directly via a CLI client with inline SQL instead of a migration framework; CommandRegex should be scoped to unexpected callers (e.g. web-facing service accounts) rather than the CREATE statement alone.

level: medium

Related sub-techniques

Explore